Issue:
======
Simple Network Management Protocol (SNMP) is an Internet standard
protocol for managing disparate network devices such as firewalls,
computers, and routers. All versions of Windows except Windows ME
provide an SNMP implementation, which is neither installed nor
running by default in any version.

A buffer overrun is present in all implementations. By sending a
specially malformed management request to a system running an
affected version of the SNMP service, an attacker could cause a
denial of service. In addition, it is possible that he cause code
to run on the system in LocalSystem context. This could
potentially give the attacker the ability to take any desired
action on the system.

A patch is under development to eliminate the vulnerability.
In the meantime, Microsoft recommends that customers who use the
SNMP service disable it temporarily. Patches will be available
shortly, at which time we will re-release this bulletin with
updated details.

Mitigating Factors:
====================
- The SNMP service is neither installed nor running by default
in any version of Windows.

- Standard firewalling practices recommend blocking the port
over which SNMP operates (UDP ports 161 and 162). If these
recommendations have been followed, the vulnerability could
only be exploited by an intranet user.

- Standard security recommendations recommend against using SNMP
except on trusted networks, as the protocol, by design,
provides minimal security.

Patch Availability:
===================
- A patch is under development and will be available shortly.
When this happens, we will re-release this bulletin with
information on how to obtain and install the patch.
Please read the Security Bulletin at
http://www.microsoft.com/technet/security/bulletin/ms02-006.asp for information on steps to protect against the vulnerability
until the patch is ready.

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
IN NO EVENT
SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY
DAMAGES
WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL,
LOSS OF
BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR
ITS
SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME
STATES DO
NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL
OR
INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.